>Number:         28739
>Category:       bin
>Synopsis:       buffer overflow in apropos
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Dec 21 20:09:00 +0000 2004
>Originator:     Michael Santos
>Release:        NetBSD 2.99.11
>Organization:
	
>Environment:
	
	
System: NetBSD ack 2.99.11 NetBSD 2.99.11 (ack) #89: Sun Dec 19 17:17:33 EST 2004 root@ack:/home/build/src/sys/arch/i386/compile/obj/ack i386
Architecture: i386
Machine: i386
>Description:
export GARBAGE=$(perl -e 'print "A"x20000')
apropos -P $GARBAGE hello
apropos -m $GARBAGE hello
export MANPATH=$GARBAGE; apropos hello

>How-To-Repeat:
See above.

>Fix:
Index: apropos.c
===================================================================
RCS file: /cvsroot/src/usr.bin/apropos/apropos.c,v
retrieving revision 1.24
diff -U2 -r1.24 apropos.c
--- apropos.c   30 Oct 2004 16:10:46 -0000  1.24
+++ apropos.c   20 Dec 2004 16:52:09 -0000
@@ -160,5 +160,5 @@

if (buildpath) {
-           (void)sprintf(hold, "%s/%s", name, _PATH_WHATIS);
+           (void)snprintf(hold, sizeof(hold), "%s/%s", name, _PATH_WHATIS);
            name = hold;
}

>Unformatted: